In this article 8 sections
Quarterly business reviews are the most underused commercial tool in MSP-land. They justify your pricing without you having to defend it.
Here’s the version of the QBR that holds margin and opens up expansion deals.
Why does a QBR justify pricing better than any contract clause?
Pricing pressure shows up in 2 places. Renewal time. And during the year when a client compares your invoice with a cheap quote.
A contract clause can’t help you in either moment. The clause says you charge £X. It doesn’t say why. The QBR is where the why lives.
A good QBR shows the client what they got for the money in the previous quarter. In specifics. “237 vulnerabilities patched in the last 90 days. 14 phishing emails blocked before they reached your team. 99.94% backup success rate against your RPO of 1 hour. 8 hours of unplanned outages avoided based on the 4 critical incidents we caught proactively.”
Once that conversation happens, the conversation about a cheaper alternative changes shape. The cheaper provider’s quote is a price. Yours has 237 patches, 14 blocked phish, and 99.94% backup success behind it. The client now has a frame to compare like with like, and they don’t have it without you running the QBR. Clients see what they pay for, so a cheaper quote has to match the standard, not just the price.
(The Assurix platform pulls patching, SLA and CSAT figures from the PSA and RMM you already run, and refreshes these live measures every six hours. Per-client views are on the roadmap.)
Self-reported numbers still need an independent check. At Labyrinth, a vendor’s policy setting left real patching at 47% while the MSP’s own reporting showed 95%. Assurix’s monitoring flagged it.
What should be on a QBR slide if you want to defend price?
6 slides, in this order.
Slide 1: Service summary
What we delivered, in plain English. “We answered 412 tickets, resolved 96% within SLA, and prevented 4 outages.”
Slide 2: Security posture
MFA coverage, EDR coverage, patch compliance, backup success, last security incident. If a number’s down, lead with it. Honesty plays better than cover-ups every time.
Slide 3: Operational risk surface
Top 3 risks the MSP is currently tracking on the client’s environment. End-of-life software, missing controls, unpatched edge devices. With a recommended action and a quote.
Slide 4: User experience
CSAT score from the client’s own users, ticket volume by priority, top 3 user issues. Lets the client see what their team is actually experiencing, not what you’re hearing third-hand.
Slide 5: Compliance and audit position
Cyber insurance status, framework readiness (CE+, ISO 27001), upcoming audit dates. This is the slide that sells expansion. The client sees their compliance posture and what’s missing.
Slide 6: Strategic priorities for next quarter
3 things you and the client both think matter. Owned. Dated. Sized.
That’s it. 6 slides. 30 to 45 minutes of meeting. No vendor logos, no “trusted partner” guff, no graphics that take a senior engineer 3 hours to format.
(Assurix already pulls patching, SLA and CSAT figures from the tools you run. Per-client views, which would feed these slides directly, are on the roadmap.)
Who needs to be in the room?
Two people from the client, two from you. No more.
From the client: the budget holder, and the operations or security lead. The budget holder cares about commercial value. The operations lead cares about whether your service is actually working day-to-day. If the budget holder’s the only one in the room, the QBR drifts into a sales pitch. If the operations lead’s the only one in the room, the QBR drifts into a status update.
From you: the account manager, and the technical lead who owns the client’s environment. Account manager owns the relationship and the commercial frame. Technical lead owns the answers when the operations lead asks something specific. If the technical lead can’t make it, reschedule. The QBR without the technical voice loses its bite.
Don’t bring the CEO. Don’t bring sales engineers who don’t know the client. Don’t bring “the new junior to learn the format.” All 3 additions dilute the meeting.
How often should you actually run QBRs?
Quarterly, sticking to the name, for clients above a defined revenue threshold (most MSPs use £24k ARR or £2k MRR). Every 6 months for the layer below that. Annually for the bottom 30% of the book.
The temptation is to run QBRs for everyone. Don’t. A QBR for a £6k ARR client costs you more in time than the client’s net profit margin. Run a 30-minute remote check-in instead, with a single dashboard PDF.
The other temptation is to skip QBRs when the client’s calm. That’s the worst time to skip. The QBR locks in the perceived value during the period when nothing’s broken. If you only show up when there’s a problem, the client only associates you with problems.
The discipline is calendar discipline. Block the QBRs for the next 12 months at the start of the year. Don’t move them unless someone’s actually unavailable.
How do you handle a QBR when something went wrong?
Lead with the problem.
If you had a 4-hour outage in the quarter, slide 1 of the QBR is the outage. What happened, why it happened, what you’ve changed to prevent it.
The instinct is to bury the bad news in the middle. Don’t. The client already knows. They’re waiting to see whether you’ll mention it. If you don’t, you’ve confirmed the worst suspicion: that you’ll cover for yourself when it matters.
The right move is the opposite. Open with the bad. Be specific. Take ownership. Then move into the positive.
How do you use the QBR to expand the account without sounding like a sales pitch?
Three questions, embedded in the meeting, none of them asked for sales reasons.
Question 1, on slide 3 (operational risk)
“These three risks need investment to fully resolve. Want to scope them as projects, or accept and document the residual risk for now?” It’s an operational question. The client either says “scope them” or “document them.” Either way, you’ve named the work.
Question 2, on slide 5 (compliance)
“Your insurer’s renewal is in October. The questionnaire’s likely to ask about X and Y. Should we do the readiness work in advance, or wait?” Again, operational. The client decides. If they say “wait,” you’ve planted the flag. If they say “advance,” you’ve scoped a project.
Question 3, on slide 6 (strategic priorities)
“If you had to pick the one outcome from us next quarter that would matter most commercially, what would it be?” That’s the highest-return question in the meeting. Their answer tells you what to upsell against.
Frequently asked questions
What if the client cancels the QBR every quarter?
Then the contract has a problem the QBR isn’t going to fix. Escalate to the budget holder once, ask why, and listen. If it keeps happening, the relationship’s already drifting and the QBR was a leading indicator.
Should the QBR be in person or remote?
Remote for clients under £50k ARR. In person at least once a year for clients above. The annual in-person QBR is one of the best retention investments an MSP can make.
What if we don’t have the data for half these slides?
Then the QBR becomes the forcing function for getting the data. You can’t run a meaningful QBR without service metrics, security metrics, and CSAT. If you don’t have them, work backwards from the QBR slide template and stand the data up over the next quarter.
How long should the deck be?
6 slides is the cap. Anything more, you’re padding. The client will respect a sharp 30-minute QBR more than a 90-minute slide tour.
Can the QBR be a template?
Per-client, yes. Per-MSP, no. Build a template per client based on what they care about, then update each quarter.
Show clients what they pay for
Your Trust Portal shows patching, SLA and CSAT, checked by Assurix.
